CVE-2026-15665 is a stored cross-site scripting vulnerability in the Fluent Support – Helpdesk & Customer Support Ticket System WordPress plugin. The vulnerability arises from insufficient sanitization and escaping of the 'redirect-to' shortcode attribute, allowing authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute when a user views the injected page. The attack vector is limited by the payload being hidden and only firing in certain browsers with specific access keys, reducing the likelihood of exploitation. The vulnerability affects all plugin versions up to and including 2.3.0.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts that execute in the context of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens, but does not affect availability. The attack complexity is low, but the requirement for authenticated access and specific browser conditions reduces the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to shortcode usage. Avoid using the vulnerable 'redirect-to' shortcode attribute if possible.